Suspicious ^80% windows Download

cliamp

Ransomware encryption indicators present

Potential format string vulnerabilityAccount credential store identifier

SHA-25614980d71183a3bfa7931e12be9977754451a2a5c209d9639755bfed277e1d819

URLhttps://github.com/bjarneo/cliamp/releases/download/v2.0.0/cliamp-windows-amd64.exe#/cliamp.exe

MaleculeO₃(XeAsCa₂)H₇(Cm₂₂Cr₁₁Db₅F₂MgOs₇U)Md₄(Bi₃Pt)

Evidence

Go reflect package name fragment in .text 0x5158e–0x5164e

⋯3 more rows
0x515be8b44244884c9751e4883fb087c1248b9.D$H..u.H...|.H.
0x515ce7265666c6563742e4839080f94c1eb02reflect.H9......
0x515de31c984c9740a31c031db4883c4505dc31...t.1.1.H..P].
⋯7 more rows

Go memory profiler string fragment in .text 0x63c30–0x63cf0

⋯3 more rows
0x63c6000488b7c243075474883ff0e754149b8.H.|$0uGH...uAI.
0x63c706d656d70726f66694c39017532817908memprofiL9.u2.y.
0x63c806c65726175296681790c746575214889lerau)f.y.teu!H.
⋯7 more rows

Go time.Location type name fragment in .text 0xb7caf–0xb7dcf

⋯3 more rows
0xb7cdf90e85bfffcff488b9424b000000049b8..[...H..$....I.
0xb7cef74696d652e4c6f634c89041066c74410time.LocL...f.D.
0xb7cff08616ce9b5010000488d5a0e4839d973.al.....H.Z.H9.s
⋯3 more rows
0xb7d3f000048899c24b000000048898c24b800..H..$....H..$..
0xb7d4f000048b974696d652e4c6f6348890c10..H.time.LocH...
0xb7d5f48b96f636174696f6e2848894c100649H.ocation(H.L..I
⋯7 more rows

Repeated %n markers in writable data 0xff367a–0xff379a

⋯5 more rows
0xff36ca086e20b0086e20b0186e20b2186e206a.n ..n ..n ..n j
0xff36da256e2054366e2056366e2058366e205a%n T6n V6n X6n Z
0xff36ea366e20823b6e20843b6e20303f6e20c86n .;n .;n 0?n .
⋯11 more rows

Writable data has %n and format specifiers 0x10071a6–0x10072d6

⋯5 more rows
0x10071f6186e20b8186e20ba186e20bc186e206c.n ..n ..n ..n l
0x1007206256e206e256e2070256e2072256e2068%n n%n p%n r%n h
0x1007216256e20002f6e20022f6e20042f6e205c%n ./n ./n ./n \
0x1007226366e205e366e20863b6e20be416e20b46n ^6n .;n .An .
⋯11 more rows